Central Intelligence Agency 



Washington, D.C. 20505 


5 July 2019 

Ms. Emma Best 
MuckRock News 
DEPT MR 73093 
411A Highland Avenue 
Somerville, MA 02144 

Reference: F-2019-01722 

Dear Ms. Best: 

This is a final response to your 16 May 2019 correspondence requesting records under the Freedom 
of Information Act (FOLA) request. Specifically, your request is for records, emails, memos, and 
reports relating to or mentioning Bureau 121, a North Korean cyberwarfare agency, which is 
part of the Reconnaissance General Bureau of North Korea’s military. 

We have completed a thorough review of your request and have determined in accordance with 
Section 3.6(a) of Executive Order 13526, the CIA can neither confirm nor deny the existence or 
nonexistence of records responsive to your request. The fact of the existence or nonexistence of 
such records is itself currently and properly classified and is intelligence sources and methods 
information protected from disclosure by Section 6 of the CIA Act of 1949, as amended, and 
Section 102A(i)(l) of the National Security Act of 1947, as amended. Therefore, your request is 
denied pursuant to FOIA exemptions (b)(1) and (b)(3). I have enclosed an explanation of these 
exemptions for your reference and retention. As the CIA Information and Privacy Coordinator, I 
am the CIA official responsible for this determination. You have the right to appeal this response 
to the Agency Release Panel, in my care, within 90 days from the date of this letter. Please include 
the basis of your appeal. 

If you have any questions regarding our response, you may contact us at: 

Central Intelligence Agency 
Washington, DC 20505 
Information and Privacy Coordinator: 

703-613-3007 (Fax) 

Please be advised that you may seek dispute resolution services from the CIA’s FOIA Public 
Liaison or from the Office of Government Information Services (OGIS) of the National Archives 
and Records Administration. OGIS offers mediation services to help resolve disputes between 
FOIA requesters and Federal agencies. You may reach CIA’s FOIA Public Liaison at: 


703-613-1287 (FOIA Hotline) 


The contact information for OGIS is: 

Office of Government Information Services 

National Archives and Records Administration 

8601 Adelphi Road - OGIS 

College Park, MD 20740-6001 

202-741-5770 

877-864-6448 

202-741-5769 (fax) 

ogis@nara.gov 

Contacting the CIA’s FOIA Public Liaison or OGIS does not affect your right to pursue an 
administrative appeal. 

Sincerely, 

4*1 ^ 

Mark Lilly 

Information and Privacy Coordinator 
Enclosure 


Explanation of Exemptions 


Freedom of Information Act ; 

(b)(1) exempts from disclosure information currently and properly classified, pursuant to an 
Executive Order; 

(b)(2) exempts from disclosure information which pertains solely to the internal personnel rules 
and practices of the Agency; 

rb v 3) exempts from disclosure information that another federal statute protects provided that the 

(W( ’oTSl statute either requires that the matters be withheld, or esutbhshes g«b> 
criteria for withholding or refers to particular types of matters to l» »t*held TI)e (b)( ) 
statutes upon which the CIA relies include, but are not limited to, the CIA Act of 1949, 

(b)(4) exempts from disclosure trade secrets and commercial or financial information that is 
obtained from a person and that is privileged or confidential; 

(b)(5) exempts from disclosure inter-and intra-agency memoranda or letters that would not be 
available by law to a party other than an agency in litigation with the agency, 

, (b)(6) exempts from disclosure information from personnel and medical files and similar files the 
disclosure of which would constitute a clearly unwarranted invasion of privacy; 

(b)(7) exempts from disclosure information compiled for law enforcement purposes to the extent 

( that the production of the information (A) could reasonably be expected to interfere with 
enforcement proceedings; (B) would deprive a person of a right to a fair trial or an 
impartial adjudication; (C) could reasonably be expected to constitute an unwarranted 
invasion of personal privacy; (D) could reasonably be expected to disclose the identity of 
confidential source or, in the case of information compiled by a criminal law enforcement 
authority in the course of a criminal investigation or by an agency conducting a lawful 
national security intelligence investigation, information furnished by a confidential source , 
(E) would disclose techniques and procedures for law enforcement investigations or 
prosecutions if such disclosure could reasonably be expected to risk circumvention of the 
law; or (F) could reasonably be expected to endanger any individual s life or physical 

safety; 

(b)(8) exempts from disclosure information contained in reports or related to examination, 
operating, or condition reports prepared by, or on behalf of, or for use of an agency 
responsible for regulating or supervising financial institutions; and 

(b)(9) exempts from disclosure geological and geophysical information and data, including maps, 
concerning wells. 
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